Blue Team
This is personal. It all starts with a seemingly innocent, but BS posturing statement, “I’ve consulted the last four presidential administrations on securing critical infrastructure.” The knee-jerk reply (mine) went something like this, “Awesome! Has the security of critical infrastructure gotten better since you started consulting presidents?” One exchange of two short sentences was all it took. You’d think CISA’s got this covered, right? After all, they’re “America’s Cyber Defense Agency”. Sure, but you’d be wrong. Despite the billions of dollars spent since 2018, CISA didn’t even have a strategic plan until last year (2023). Despite the title of the talk, I’ll spend more time talking about what we’re doing than beating up on CISA. Truth is, we can’t wait for CISA to do what we’re going to do ourselves. Questions for you: What would you do to secure critical infrastructure in the United States? Where would you start?
Evan Francen, Founder of FRSecure LLC/Co-founder and CEO of SecurityStudio
Author of UNSECURITY: Information security is failing. Breaches are epidemic. How can
we fix this broken industry?
Evan is a veteran information security expert, with more than 30 years of “practical” information security
experience, and an ambitious mission; fix the broken industry. Highlights of Evan’s career (thus far) include:
• Founded FRSecure in 2008, an expert-level information security consulting company with more 100
employees and 2,500 clients across the United States.
• Founded SecurityStudio in 2017, a software as a service (SaaS) company dedicated to building a
community of information security practitioners who speak the same “security language”.
• Co-creator of S2
Score, a definitive measurement of information security risk.
• Co-creator of S2
Org, the organizational security assessment used by more than 50 partners and 7,000
organizations across 32 industries to assess and manage information security risk.
• Co-creator of S2
Vendor for third-party information security risk management, S2
School for
information security risk management in K-12, S2
Team for unparalleled insight into personal security
habits, and S2
Me, for personal information security risk management.
• Created the Certified virtual Chief Information Security Officer (CvCISO™) Program, the first
certification for vCISOs in the industry.
• Developed and lead the free FRSecure CISSP® Mentor Program. Established in 2010 with six students,
the program and has grown to more than 20,000 students representing 100+ countries in 2023.
• Prior to establishing FRSecure, Evan spent more than 15 years as a leading information security
professional and corporate leader in both private and public companies.
• Creator of Project Broken Mirror, a community effort to secure the public sector.
• Advised legal counsel in high-profile breaches including Target and Blue Cross/Blue Shield.
o 2014/2015 - Consultant to the Special Litigation Committee of the Board of Directors of Target
Corporation; derivative action related to the “Target Breach”.
o 2015/2016 – Consultant to legal counsel and Blue Cross/Blue Shield related to remediation
efforts (post-breach).
o Served as an expert witness in several federal criminal cases, most involving alleged stolen
trade secrets by foreign adversaries.
• Served 100s of companies; big (Wells Fargo, Target, US Bank, UnitedHealth, etc.) and small.
• Delivered dozens of information security talks at dozens of conferences; audiences ranging from less
than 10 to more than a 5,000.
• Written more than 750 published articles about a variety of information security topics.
An “information security evangelist”, thought leader and specialist in advising Boards of Directors, legal
counsel, and executive management. His unique sense of humor, and “tell it like it is” demeanor, gets the
point across and produces results for all audiences.
Outside of work, Evan is still a “hacker”, but he’s also a proud father of five children, with six grandchildren, an
avid scuba diver, motorcyclist, guitar player, welder, and tinkerer.
We proudly present SecretCon, an entirely unparalleled conference for the state of Minnesota, built for our new digital reality. This conference is dedicated to the many specialties of our hacker, cybersecurity, and privacy community. We have taken it upon ourselves to construct a conference that not only embraces our past, but also looks to the future. Join us!
